50th International Conference on Environmental Systems ICES-2021-134 12-15 July 2021

ExoMars Rover Module: Verification of the Loop Heat Pipes thermal performance in system level testing

V. Laneve1 ESA ESTEC / RHEA System B.V., Noordwijk, 2201 AZ, The Netherlands

M. Munì2 and L. Tentoni3 Thales Alenia Space, Torino, 10146, Italy

and

L. Tamkin4 Airbus Defence and Space Ltd., Stevenage, SG12AS, United Kingdom

The ExoMars program is a joint endeavor between ESA and Roscosmos. It includes the launched in 2016 and the Rover and Surface Platform mission, whose launch has been recently rescheduled for 2022. The ExoMars Rover Module (developed by Airbus Defence and Space and Thales Alenia Space) underwent its system level test campaigns in 2018 and 2019. One of the key features of the Rover Module thermal design is the use of Loop Heat Pipes acting as heat switches to insulate the rover internal equipment and payloads during the cold Martian night and rejecting the heat dissipated by the electronics units when the rover is operating during the day. The ExoMars Rover Module is equipped with four Loop Heat Pipes, two of them integrated in the Service Module (SVM) and the other two on the Analytical Laboratory Drawer (ALD). Each Loop Heat Pipe is designed to transport up to 50 W and operate at temperatures from -50°C to +55°C at the evaporator and from -120°C to +55°C at the condenser. The vapor modulation and switching function is achieved by means of Pressure Regulating Valves. This paper will provide an overview of the activities performed at system level to verify the functional performance of the Rover Module Loop Heat Pipes and their main outcomes.

Nomenclature AA = Aluminium Alloy AIT = Assembly, Integration and Testing ALD = Analytical Laboratory Drawer CEU = Control Electronic Unit CO2 = Carbon Dioxide DM = Descent Module FPGA = Field Programmable Gate Array GN2 = Gaseous Nitrogen IMU = Inertial Measurement Unit ISEM = Infrared Spectrometer for ExoMars LHP = Loop Heat Pipe MOMA = Mars Organic Molecule Analyzer OBC = On-Board Computer PCDE = Power Conditioning and Distribution Electronics

1 ExoMars RSP Thermal Systems Engineer, TEC-MTT, [email protected] 2 ExoMars RM Thermal Systems Engineer, Thermal Systems, [email protected] 3 Thermal Engineer, Thermal Engineering, [email protected] 4 MSR-SFR STHS Development Manager and Thermal Lead, Thermal Engineering, [email protected]

Copyright © 2021 PFM = Proto-Flight Model PRV = Pressure Regulating Valve RHU = Radioisotope Heating Unit RLS = Raman Spectrometer RM = Rover Module RSP = Rover and Surface Platform SPDS = Sample Preparation and Distribution System SS = Stainless Steel STM = Structural and Thermal Model SVM = Service Module TCS = Thermal Control Sub-system TVAC = Thermal-Vacuum UCZ = Ultra-Clean Zone WISDOM = Water Ice and Subsurface Deposit Observation on Mars

I. Introduction HE ExoMars program is a joint endeavor between ESA and Roscosmos. In addition to the Rover and Surface T Platform (RSP), it also includes the Trace Gas Orbiter launched in 2016. A Proton rocket will be used to launch the RSP mission, which is planned to arrive at Mars after a nine month journey. The Rover Module (developed by Airbus Defence and Space and Thales Alenia Space) will travel across the Martian surface to search for signs of life. It will collect samples with a Drill (developed by Leonardo) and analyse them on its on-board laboratory (ALD). A total of nine scientific payloads are hosted on the Rover Module. They are provided by ESA member states, NASA and IKI/Roscosmos. The Surface Platform, developed by Roscosmos and IKI, will remain stationary and investigate the surface environment at the landing site. The Rover Module underwent its system level thermal testing in 2018 (STM) and 2019 (PFM) at Airbus Defence and Space test facilities in Toulouse.

II. Thermal Design of the ExoMars Rover The thermal design of the ExoMars Rover Module was discussed in the past in Ref. 1. However, during the development of the project, some modifications were introduced in order to improve the performance of the rover. Therefore, a brief overview of the main features of the RM thermal design is provided in this section. The RM thermal design is characterized by three distinct thermal zones that are controlled independently (see Figure 1 and Figure 2): 1) SVM zone: the area inside the rover body where the warm electronics are accommodated. It is thermally isolated from the external environment and the ALD. Two units (the ADRON and ISEM payloads) lie outwith the SVM zone but are conductively connected to the main SVM panel with thermal straps. 2) ALD zone: the area inside the rover body where the three analytical instruments (MOMA, RLS and MicrOmega) are located. 3) External zone: the area outside the main rover body that is subjected to the full swing of environmental conditions on Mars. The volume inside the rover body is thermally insulated from the external volume and is thermally split in two by a barrier through the center of the structure to form the zones described above. The thermal decoupling between the rover internal volume and the external environment relies on the insulation provided by the low pressure CO2 atmosphere on Mars (gas-gap concept with typical size of 20mm to 30mm achieved by means of inner baffles2,3), the use of optical finishes with low IR emissivity, isostatic mounts with low thermal conductance and LHPs. The LHPs are used as heat switches to assure a high thermal de-coupling between internal zones (SVM, ALD) and cold external environment during the Martian night and to remove the heat generated by the electronic units during the day, thus allowing normal operations such as traversing and scientific experiments. Furthermore, RHUs and heaters are installed to maintain the temperature of the SVM and ALD within the allowable range in the cold phases of the surface mission. The SVM hosts within its insulated space, the Battery, the Transceivers, the IMUs, the OBC, the PCDE, the WISDOM electronic unit and two RHUs (each of 8.5±0.5 W dissipation). Among the units accommodated on the SVM panel, the Battery has the most stringent requirements for thermal control and has driven the selection of the control set-point of the SVM LHPs (i.e. 0°C). The support panel in the center of the SVM equipment is designed to

2 International Conference on Environmental Systems

provide both mechanical support and thermal coupling. As such the RHUs and LHPs are mounted onto this panel in order to ensure an adequate heat spreading or rejection during a sol. In addition to MOMA, RLS and MicrOmega, the ALD hosts the SPDS and the CEU and provides the necessary structural support and thermal control functions. A contamination controlled volume, called Ultra Clean Zone (UCZ), is located on the lower panel. The processing of the samples extracted by the Drill and the specimen’s preparation, as well as the “life-detection” analyses, are performed within the UCZ. The ALD is equipped with one RHU, two LHPs, survival and warm-up heaters.

Figure 1. Overview of the Rover Module internal layout: top view without Solar Array (left) and cross- sectional view in stowed configuration (right).

Figure 2. Overview of the Rover Module external layout in deployed configuration 3 International Conference on Environmental Systems

Figure 3. SVM (Left) and ALD (Right) accommodation

III. The ExoMars Rover Loop Heat Pipes The RM is equipped with four Loop Heat Pipes, two of them integrated in the SVM and the other two in the ALD. Each Loop Heat Pipe is designed to transport up to 50 W and operate at temperatures from -50°C to +55°C at the evaporator and from -120°C to +55°C at the condenser. As a consequence of the temperatures expected on Mars, propylene has been selected as working fluid. In the RM PFM the radiators are white-painted with inorganic coating (AZ2100-IECW). A summary of the main design features of the LHPs is presented in Table 1. The vapor modulation and switching function is achieved by means of Pressure Regulating Valves (PRVs). The PRV operation is driven by the movement of a piston which depends on the pressure balance between the working fluid in the LHP and in the PRV reservoir, filled with argon. The valve operation is fully passive: the working fluid pressure is related to the LHP operating temperature (saturation curve), whereas the argon (gas) pressure variation is much lower within the same temperature range. The difference in pressure between the two fluids leads to the piston movement. The LHP has basically three operational modes. In the first mode (“ON mode”), the PRV is fully open. The pressure of the working fluid in the LHP is higher than the pressure of the argon plus the piston load, therefore the LHP can be considered as a constant conductance device. In the second mode (“regulation mode”), the PRV piston moves closer to the fully closed position. In this situation, there is still fluid circulation in the LHP, but the PRV position causes an additional pressure drop, which is reflected in a decrease of the thermal conductance of the LHP. Finally, the third operational mode corresponds to the “OFF mode”, in which the PRV is fully closed and therefore no fluid circulation exists in the LHP. The thermal conductance in this case corresponds only to the conduction through the LHP transport lines. Two different set-points have been chosen for the ALD and SVM PRVs, namely: -40°C for the ALD (to assure the preservation of the Martian soil samples) and 0°C for the SVM (mainly driven by the Battery allowable temperature range). More details about the design and testing at equipment level of the RM LHPs can be found in Ref. 4 and 5.

Component Parameter ALD LHP Low ALD LHP Up SVM LHPs Evaporator case Material SS 316L SS 316L SS 316L Length 147 mm 147 mm 147 mm Evaporator saddle Material AA 6082-T6 AA 6082-T6 AA 6082-T6 Saddle footprint 115x46 mm 115x46 mm 115x46 mm Compensation Chamber Material SS 316L SS 316L SS 316L Length 80 mm 80 mm 80 mm Outer Diam. 21 mm 21 mm 21 mm Primary wick Material SS 316L SS 316L SS 316L Outer Diam. 11 mm 11 mm 11 mm Porosity 65% 65% 65% Pore diam. 2.2 μm 2.2 μm 2.2 μm Vapor Line Material SS 316L SS 316L SS 316L 4 International Conference on Environmental Systems

Component Parameter ALD LHP Low ALD LHP Up SVM LHPs Inner Diam. 2.0 mm 2.0 mm 2.0 mm Outer Diam. 3.0 mm 3.0 mm 3.0 mm Length 1.8 m 0.9 m 1.4 m Liquid Line Material SS 316L SS 316L SS 316L Inner Diam. 1.5 mm 1.5 mm 1.5 mm Outer Diam. 2.0 mm 2.0 mm 2.0 mm Length 1.3 m 0.5 m 1.2 m Condenser Material SS 316L SS 316L SS 316L Inner Diam. 2.0 mm 2.0 mm 2.0 mm Outer Diam. 3.0 mm 3.0 mm 3.0 mm Length 1.2 m 2.2 m 0.8 m Radiator Plate Area 0.10545 m2 0.2054 m2 0.064 m2 Working Fluid Propylene 16.8 g 16.1 g 16.1 g Table 1. ExoMars LHPs Main Design Features

Nominally, the RM LHPs are designed to start and stop autonomously under the thermal environment foreseen during the mission. However, in specific situations (e.g. PRV failed open, very low heat flow in the evaporator or unfavorable distribution of the working fluid), the LHPs might not operate as expected. To compensate for these conditions, the LHPs are monitored by means of thermistors installed in specific locations. Start-up and shut-down heaters (respectively installed on the evaporator and the compensation chamber) are implemented as back-up design solution to restore a proper functioning of the LHPs in case of off-nominal behavior. In order to actively monitor the status of a LHP, a control logic is required that examines the state of the LHP and activates or deactivates it according to the actual need. The status of the LHP can be actively monitored:  to monitor the LHP status (e.g. ON or OFF),  to activate the LHP if required,  to deactivate the LHP if required,  to identify if the LHP has failed to start or stop as commanded. The implementation of the LHP monitoring and control logic is constrained by the available resources. The number of temperature measurement points must be minimized for mass and complexity reasons whilst ensuring some redundancy. A schematic of the LHP instrumentation (location of the thermistors, start-up and shut-down heaters) is shown in Figure 4. Should the PRV fail open, the capability to deactivate the LHP is considered a critical function for the survivability of the RM; therefore, it has to be available throughout the mission in all of the RM modes. This is achieved by embedding the “shut-down” control logic in the FPGA of the PCDE, which is always active during the mission. The “shut-down” control logic performs mainly two types of checks to decide whether the “shut-down” heater should be activated. The first check is performed on the temperature of the evaporator. If the evaporator temperature drops below the PRV set-point by a given value (i.e.: -6.5°C for SVM LHPs and -46.5°C for ALD LHPs), it is considered a sign that the PRV may be failed in open position and, therefore, the “shut-down” heater activation is needed. A second check is performed on the temperature gradient between the evaporator and the compensation chamber. In an operating LHP, the evaporator is expected to be warmer than the compensation chamber by a given ΔT; hence, by checking the temperature difference between the evaporator and the inlet of the compensation chamber, it is possible to understand whether the LHP is still operating. The “shut-down” heater is activated only if the control logic detects that there is still fluid circulation within the LHP. In order to increase the robustness of the “shut-down” control logic against possible thermistor failures, two thermistors are mounted on the evaporator (labelled “EV” and “EVout” in Figure 4) and three thermistors at the inlet of the compensantion chamber (labelled “CCin_1”, “CCin_2” and “CCin_3” in Figure 4). The following thresholds are set for the ΔT between evaporator and inlet of the compensation chamber: 5°C for SVM LHPs; 1.5°C for the ALD LHPs. On the other hand, the “start-up” control logic is not deemed as essential for the survivability of the rover. Therefore, it is coded in the OBC, that is indeed switched off in some RM contingency modes (e.g. hibernation). In addition to the PRV set-point and ΔT between evaporator and compensation chamber, the “start-up” control logic uses also the ΔT between the evaporator and the condenser inlet and the ΔT between the condenser inlet and outlet to assess the status of the LHP and decide whether a “start-up” heater should be activated.

5 International Conference on Environmental Systems

It is worth noting that during the cruise phase the rover OBC is switched on for limited periods (e.g. check-outs). In this phase of the mission, the “start-up” function is performed by the computer of the spacecraft hosted in the Descent Module (DM). The position of the flight thermistors installed nearby the LHPs and acquired during cruise by the DM computer is shown in Figure 5. Table 2 shows a summary of the installed heater power for each line.

Figure 4. Schematic of LHP instrumentation

Figure 5. Temp. Sensors acquired in start-up test with DM heaters

6 International Conference on Environmental Systems

Control Min. Voltage Max. Voltage Min. Power Max. Power Description Unit (V) (V) (W) (W) Shut-down Heaters SVM LHP 1 & 2 19.81 29.4 4.49 9.89 Shut-down Heater RM ALD LHP Up 19.81 29.4 4.49 9.89 PCDE Shut-down Heater ALD LHP Low 19.81 29.4 4.49 9.89 Shut-down Heater Start-up Heaters (Mars Surface) SVM LHP 1 & 2 24.64 29.4 13.2 18.79 Start-up Heater RM ALD LHP Up 24.64 29.4 11.75 16.73 OBC/RTB Start-up Heater ALD LHP Low 24.64 29.4 12.11 17.25 Start-up Heater Start-up Heaters (Cruise) DM SVM LHP 1 & 2 24.0 28.3 6.25 8.69 Start-up Heater DM ALD LHP Up DM 24.0 28.3 6.25 8.69 Start-up Heater DM ALD LHP Low 24.0 28.3 6.25 8.69 Start-up Heater Table 2. Installed Power – Shut-down and Start-up Heaters

IV. Verification of the LHPs performance in system level testing The system level verification of the ExoMars RM thermal design is based on a “STM + PFM” philosophy. The verification approach at STM level foresaw testing in the two different mechanical configurations: stowed and deployed. At PFM level, testing was in deployed configuration only, mainly due to the need to find a balance between technical and programmatic constraints. Hot and cold balance phases in vacuum and GN2 were undertaken as well as hot and cold plateaus dedicated to functional testing of equipment and scientific payloads. Four cycles (one hot science, one hot traverse, one cold science and one hibernation) were conducted. Figure 6 shows the thermal test sequence used for the RM PFM thermal test. A more detailed discussion of the challenges linked to the testing of the ExoMars RM can be found in Ref. 6.

Figure 6. RM PFM Thermal Test Sequence

7 International Conference on Environmental Systems

Specific phases of the PFM test were dedicated to the verification of the LHPs performance. In particular, it is worth noting that the RM PFM thermal test represented the only opportunity to perform a full end-to-end verification (with hardware and software in the loop) of the LHPs control logic in the relevant mission environment. The key objectives of the PFM thermal test with respect to LHPs verification can be summarized as follows:  Verification of the nominal thermal behavior of the LHPs, i.e. capability of the LHPs to start/stop working autonomously when subjected to environmental conditions and internal heat loads representative of the Mars surface mission (Test Phase 11 to 14).  Verification of the LHPs back-up design features, which includes the verification of the capability to start-up the LHPs with the DM controlled heaters (Test Phase 1), the capability to shut-down (Test Phase 3 and 11) and start-up (Test Phase 8 and 13) the LHPs with the RM controlled heaters using the flight control logic. The selection of the test phases dedicated to the verification of the LHPs shut-down and start-up control logic was performed taking care that the environmental conditions were similar to the ones in which the control logic is expected to work on Mars. Therefore, the verification of the shut-down logic was performed in a test phase where the chamber environment was cooling down (day/night transition), whereas the testing of the start-up logic was done in a test phase where the chamber environment was warming up (night/day transition). Although a full end-to-end verification of the LHPs control logic was not possible in the RM STM thermal test, one of the lessons learnt from the STM test was the need to revise some of the thresholds used in the “shut-down” and “start-up” control logic to take into account the gradients among the measurement points recorded during the test. The PFM test allowed to check the adequacy of the implemented updates. Some key test results are presented in the following paragraphs.

A. Verification of Nominal Behavior of the SVM and ALD LHPs The verification of the correct functioning of the baseline design of the SVM and ALD LHPs was performed in several phases of the test. Figure 7 shows the temperature plots of the flight thermistors mounted on the SVM LHPs recorded in Test Phase 12 (simulation of Hot Traverse cycle). During the day, the PRVs are open and the working fluid is circulating inside the LHPs, thus guaranteeing the thermal control of the units installed on the SVM. When the valves temperature is close to 0°C, the PRVs start regulating. The temperature of the radiators drop following the cold external environment, whereas the thermistors mounted on the evaporators remain at about 0°C in line with the specified set-point value, thus preventing that the internal units could drop below their allowable temperature range during the night.

Figure 7. TP 12 – SVM LHPs natural start-up and shut-down

Figure 8 and Figure 9 show the behavior of the ALD LHPs in Test Phase 12 and 13 (Cold Science cycle). It is possible to see that the LHPs are working during the transition from day to night. At night, when the environmental temperature drops down to temperature lower than -120°C, both PRVs reach their regulation temperature. The test results show a PRV set-point of about -43°C for the ALD LHP Up and -40°C for the ALD LHP Low, in line with the results recorded in the acceptance tests performed at equipment level. 8 International Conference on Environmental Systems

Figure 8. TP 13 – ALD LHP Up natural start-up and shut-down

Figure 9. TP 12&13 – ALD LHP Low natural start-up and shut-down

B. Verification of LHPs Start-up with DM controlled heaters The verification of the capability of the LHPs to start working using the heaters controlled by the DM was performed in Test Phase 1, during the chamber pump-down. In this test phase, the RM OBC was switched off to be representative of the flight conditions in terms of heat loads. Thermocouples and flight thermistors mounted on the RM but acquired by the spacecraft OBC were used to monitor the behavior of the LHPs (see Figure 5). These temperature sensors were acquired through the data acquisition system of the TVAC chamber. Both for SVM and ALD, the LHP’s start-up was tested sequentially. Figure 10 and Figure 11 show the recorded behavior of the SVM and ALD LHPs respectively. The heater power applied on the evaporators in this test was 8 W. The switch-on of the start-up heaters was commanded by the test operators. The circulation of the fluid started within few minutes from the activation of the heaters for all LHPs. Only for the ALD UP LHP a longer time was necessary (i.e.: 1 hr and 35 min). The longer time needed to start the ALD

Figure 10. TP01 – SVM LHP’s start-up with DM-controlled heaters 9 International Conference on Environmental Systems

UP LHP was expected as similar performances were recorded also at equipment level and in the test performed in the RM STM test campaign.

Figure 11. TP 01 – ALD LHPs start-up with DM-controlled heaters

C. Verification of LHPs Start-up with RM controlled heaters The verification of the LHPs start-up with RM controlled heaters was performed in Test Phase 8 at first and subsequently repeated in some of the following test phases. The fundamental difference with respect to the test described in par. B consists in the fact that the flight control logic coded in the on-board software was used, therefore the test allowed a full end-to-end verification of the LHP’s start-up logic with flight hardware and software in the loop. It is worth noting that the control logic for the SVM LHPs is executed in the RM OBC; whereas the control logic for the ALD LHPs runs in the CEU. It is highlighted that, prior to the execution of the test, some of the Figure 13. TP 08 – ALD LHP UP start-up with RM-controlled thresholds set on the flight software to heaters (manually actuated) detect whether a forced start-up of the LHPs is necessary had to be adapted to the test conditions. Indeed the LHP’s start-up heaters are meant to be activated in flight in non-nominal scenarios in which the LHPs might not start autonomously as expected. In the RM PFM thermal test, all the LHPs worked nominally, thus confirming the absence of anomalies in the hardware installed on the rover. Therefore, in order to test this non-nominal scenario, the threshold utilized to define whether the start-up heaters should be activated was Figure 12. TP 13 – SVM LHP 1 (+Y) start-up with RM controlled decreased below the PRV’s set-point. This heaters was done to ensure that the activation of the heaters could happen before the LHPs natural start-up.

10 International Conference on Environmental Systems

The activities performed in Test Phase 8 allowed identification of some problems, in particular with the control logic of the ALD LHPs. In fact, although the conditions defined in the control logic to activate the start-up heaters were all verified, the heaters were not activated as expected. The anomaly was analyzed and two root causes were identified, namely: a wrong sign in one of the “IF-clause” of the logic and a wrong command length in the software. Therefore, the ALD heaters were actuated manually in Test Phase 8, emulating the behavior of the control logic (see Figure 13). This workaround allowed to exclude potential anomalies on the flight hardware installed on the rover. The issues affecting the software used for the control of the ALD LHPs were fixed during the test and the start-up logic was re-tested later on with a software patch. No major anomalies were detected for the SVM LHPs. Figure 12 shows the results of the SVM LHP 1 start-up test. When all the conditions defined in the control logic are satisfied, the start-up heater is activated (see black line in Figure 12 indicating the status of the start-up heater). The activation of the heater immediately causes the increase of the evaporator temperature and the generation of vapor that reaches the condenser inlet as indicated by the spikes in the temperature read by the corresponding thermistor (green line in Figure 12). When the generation of vapor starts, not all the conditions defined in the control logic are verified any longer and the heater is switched off. It is worth noting that as soon as the heater is switched off, the PRV (which is obviously not failed) closes, thus preventing a full start-up of the LHP in the first attempts. The full start-up of the LHP is finally achieved when the temperature becomes higher than the PRV set-point.

D. Verification of LHPs shut-down with RM controlled heaters The verification of the LHPs shut-down with RM controlled heaters was performed in Test Phase 3 at first. Similarly to the test of the start-up heaters, also for the shut-down heaters the flight control logic was used, therefore the test allowed a full end-to-end verification of the control logic with flight hardware and software in the loop. As mentioned previously, the main difference in the functional architecture is the fact that the shut- down control logic is coded in the PCDE FPGA rather than in the OBC. Also for this test, some thresholds in the software logic had to be modified so that the shut-down logic could be tested above the PRV’s set- point, when the circulation of the working fluid was still active. The test performed in Test Phase 3 Figure 14. TP 11 – ALF LHP UP shut-down with RM-controlled heaters was not successful. Despite all the conditions for the activation of the shut-down heaters being verified, the heaters were not switched on as expected. The anomaly was analyzed and the root cause identified in an issue with some temperature values loaded in the PCDE FPGA (erroneous calibration curves). This problem was fixed during the test and the shut-down logic was re-tested successfully at the beginning of Test Phase 11. Test results obtained for the ALD LHPs after the correction of the glitches experienced in Test Phase 3 are presented in Figure 14 in and Figure 15. It is highlighted that the shut-down logic thresholds were modified such that the control set- point temperature at the evaporator was equal to -18°C for the ALD LHP UP and -15°C for the ALD LHP LOW, Figure 15. TP 11 – ALD LHP LOW shut-down with RM-controlled whereas the values used in flight is - heaters 11 International Conference on Environmental Systems

46.5°C. The two figures show clearly a “regulating” phase where the shut-down heater is switched on and off quickly by the control logic. In the test performed, this phase lasts 75 min for the ALD LHP UP (total energy used: 1.3 Whr) and 56 min for the ALD LHP LOW (total energy used: 1.2 Whr). In the end, the circulation of the working fluid in the LHPs is stopped completely, therefore no heater power is requested any longer. For the testing of the SVM LHPs, the shut-down logic threshold was set to +7°C, whereas the value proposed for flight is -6.5°C. The total energy consumption of each SVM LHP shut-down heater was ~11.5 Whr. The test confirmed that the energy necessary to operate the shut-down heaters in case of a PRV failed open is within the available energy budget at system level.

V. Conclusion The approach adopted for the verification of the functional performance of the ExoMars RM LHPs in the PFM test campaign has been described. Conceptually, the verification activities have been organized in two blocks, i.e.: verification of the LHPs baseline design and verification of the back-up design features in place to assure the fulfillment of the specified performances in off-nominal conditions. The test allowed identification of some glitches in the flight software affecting both the “start-up” and “shut-down” control logic of the LHPs (see par. C and D). During the test it was decided to fix the glitches and the relevant test activities were repeated successfully in subsequent test phases. Obviously, repeating some test activities had an impact on the overall test duration quantifiable in about 1.5 days. Nevertheless, it was deemed as necessary to achieve a full verification of the system from a thermal standpoint, since the RM PFM test was the last opportunity to test the rover in a representative environment. The glitches detected during the RM PFM thermal test could have been found previously in the AIT activities flow during the tests performed on the software validation facility and avionics test bench. Therefore, a lesson learnt of the test is the need for a close cooperation between avionics, thermal and AIT responsibles in the definition of the test specifications and procedures used for the verification of the TCS algorithms on the relevant test benches. Furthermore the collected test data were important to confirm the thresholds to be uploaded in the flight software for the “shut-down” and “start-up” control logic.

Acknowledgments The authors would like to thank all those involved in preparing, running and supporting both the STM and PFM ExoMars Rover Module tests, coming from the European Space Agency, Airbus Defence and Space UK and France and Thales Alenia Space Italy.

References 1Alary, C., Lapensée, S., “Thermal Design of the ExoMars Rover Module”, Barcelona, 40th International Conference on Environmental Systems, AIAA 2010-6188 2 Bhandari, P., Karlmann, P., Anderson, K., Novak, K., “CO2 Insulation for Thermal Control of the ”, Portland, 41st International Conference on Environmental Systems, AIAA 2011-5119 3Tamkin, L., Nelson, E., McQuail, H., “Evaluation of Modelling Techniques for a Carbon Dioxide Gas-Gap for the ExoMars Rover and Surface Platform Mission”, Vienna, 46th International Conference on Environmental Systems, ICES-2016-402 4Munì, M., Negri F., Prado Montes, P., Alary, C., “ExoMars Rover and Surface Platform Mission: LHPs Acceptance and Qualification Campaign”, Vienna, 46th International Conference on Environmental Systems, ICES-2016-253 5Prado Montes, P., Campo, S., García, A., Torres, A., Munì M., Negri, F., “ExoMars 2020 LHPs: from the concept to the flight models”, Charleston, 47th International Conference on Environmental Systems, ICES-2017-200 6Katzenberg, J., Tamkin, L., Laneve, V., “Testing a Mars Rover – Challenges Specific to Thermal Environmental Testing of the ExoMars Rover”, ICES-2020-537

12 International Conference on Environmental Systems